Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline
Operation ASTERIX is a cryptocurrency fraud campaign involving an exposed web directory hosting tools and data to facilitate phishing and vishing attacks. The infrastructure included phone number datasets, account validation tools, phishing panels, voice-dialing scripts, and counterfeit wallet applications impersonating Ledger, Trezor, and Exodus. The operator validated around 885,000 phone numbers against crypto exchange accounts, achieving a 13.6% hit rate on German numbers. Victims were targeted with coordinated phishing emails and vishing calls referencing fake support cases, ultimately being directed to fake wallet apps designed to steal recovery phrases via Telegram exfiltration. The campaign notably leveraged AI coding assistants to develop its tools and attempted to bypass AI safety mechanisms using jailbreak prompts.
AI Analysis
Technical Summary
Researchers uncovered an exposed web directory supporting Operation ASTERIX, a cryptocurrency fraud operation. The server contained extensive resources including phone-number datasets, account-validation tools, phishing panels, voice-dialing scripts, and fake wallet applications for Ledger, Trezor, and Exodus. The operator validated approximately 885,000 phone numbers against cryptocurrency exchange accounts, with a 13.6% success rate on German numbers. Victims received coordinated phishing emails and vishing calls referencing fabricated support cases, leading them to counterfeit wallet applications designed to steal recovery phrases, which were exfiltrated via Telegram. The fraud operation used AI coding assistants such as GitHub Copilot and Claude Code extensively during development. When one AI model resisted malicious requests, the operator switched providers and used structured jailbreak prompts to bypass AI safety controls targeting the model's reasoning and safety mechanisms.
Potential Impact
The campaign enables attackers to steal cryptocurrency wallet recovery phrases through coordinated phishing and vishing attacks, potentially resulting in theft of victims' cryptocurrency assets. The use of validated phone numbers increases the likelihood of successful targeting. The counterfeit wallet applications facilitate direct theft of sensitive wallet credentials. The use of AI-assisted development and jailbreak prompts indicates a sophisticated approach to tool creation and evasion of AI safety mechanisms.
Mitigation Recommendations
No official patch or fix applies as this is a fraud campaign rather than a software vulnerability. Defenders should educate users about phishing and vishing tactics, especially related to cryptocurrency wallets. Users should verify communications purportedly from wallet providers or exchanges independently and avoid installing wallet applications from untrusted sources. Monitoring for the listed domains and hashes associated with the campaign can aid detection and blocking. Awareness of AI-assisted fraud tool development may inform threat hunting and defense strategies.
Affected Countries
United States, Bulgaria, Canada, Germany, Hong Kong, Poland
Indicators of Compromise
- domain: ledgerhelp.com
- hash: 0f2c7194f1f577e73460db9ec2e75fc0c7f845588cbd4246333b7a4fbec90d9f
- hash: 4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8
- hash: 7073b2a3a34525c5969921dd17ef1fa5607af92be78b3fc6129cdea73216691a
- hash: 918fa540126b7db6424652d84a5ce7e968947136db3d6e3e0cab30ea309e25a2
- hash: 961a398a5c71e837626b5fce68e44b14a5d220e3bd74a3d0ecd61a2762c38176
- hash: ba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19
- url: http://136.0.213.184:1337/api/kraken-numio
- url: http://app.mona.co/api/passkeys/verify_option/
- url: http://macos-claude.com:8000
- url: https://app.mona.co
- domain: 36mcrypto.com
- domain: atechservicecentre.co.uk
- domain: ledger.com.lv
- domain: macos-claude.com
- domain: ses-noreply.com
- domain: xcjnrucne9xfvmci.com
Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline
Description
Operation ASTERIX is a cryptocurrency fraud campaign involving an exposed web directory hosting tools and data to facilitate phishing and vishing attacks. The infrastructure included phone number datasets, account validation tools, phishing panels, voice-dialing scripts, and counterfeit wallet applications impersonating Ledger, Trezor, and Exodus. The operator validated around 885,000 phone numbers against crypto exchange accounts, achieving a 13.6% hit rate on German numbers. Victims were targeted with coordinated phishing emails and vishing calls referencing fake support cases, ultimately being directed to fake wallet apps designed to steal recovery phrases via Telegram exfiltration. The campaign notably leveraged AI coding assistants to develop its tools and attempted to bypass AI safety mechanisms using jailbreak prompts.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Researchers uncovered an exposed web directory supporting Operation ASTERIX, a cryptocurrency fraud operation. The server contained extensive resources including phone-number datasets, account-validation tools, phishing panels, voice-dialing scripts, and fake wallet applications for Ledger, Trezor, and Exodus. The operator validated approximately 885,000 phone numbers against cryptocurrency exchange accounts, with a 13.6% success rate on German numbers. Victims received coordinated phishing emails and vishing calls referencing fabricated support cases, leading them to counterfeit wallet applications designed to steal recovery phrases, which were exfiltrated via Telegram. The fraud operation used AI coding assistants such as GitHub Copilot and Claude Code extensively during development. When one AI model resisted malicious requests, the operator switched providers and used structured jailbreak prompts to bypass AI safety controls targeting the model's reasoning and safety mechanisms.
Potential Impact
The campaign enables attackers to steal cryptocurrency wallet recovery phrases through coordinated phishing and vishing attacks, potentially resulting in theft of victims' cryptocurrency assets. The use of validated phone numbers increases the likelihood of successful targeting. The counterfeit wallet applications facilitate direct theft of sensitive wallet credentials. The use of AI-assisted development and jailbreak prompts indicates a sophisticated approach to tool creation and evasion of AI safety mechanisms.
Defensive Guidance
No official patch or fix applies as this is a fraud campaign rather than a software vulnerability. Defenders should educate users about phishing and vishing tactics, especially related to cryptocurrency wallets. Users should verify communications purportedly from wallet providers or exchanges independently and avoid installing wallet applications from untrusted sources. Monitoring for the listed domains and hashes associated with the campaign can aid detection and blocking. Awareness of AI-assisted fraud tool development may inform threat hunting and defense strategies.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing/"]
- Adversary
- null
- Pulse Id
- 6a840692bd27524cbf560e2d
- Threat Score
- null
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainledgerhelp.com | — | |
domain36mcrypto.com | — | |
domainatechservicecentre.co.uk | — | |
domainledger.com.lv | — | |
domainmacos-claude.com | — | |
domainses-noreply.com | — | |
domainxcjnrucne9xfvmci.com | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash0f2c7194f1f577e73460db9ec2e75fc0c7f845588cbd4246333b7a4fbec90d9f | — | |
hash4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8 | — | |
hash7073b2a3a34525c5969921dd17ef1fa5607af92be78b3fc6129cdea73216691a | — | |
hash918fa540126b7db6424652d84a5ce7e968947136db3d6e3e0cab30ea309e25a2 | — | |
hash961a398a5c71e837626b5fce68e44b14a5d220e3bd74a3d0ecd61a2762c38176 | — | |
hashba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19 | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://136.0.213.184:1337/api/kraken-numio | — | |
urlhttp://app.mona.co/api/passkeys/verify_option/ | — | |
urlhttp://macos-claude.com:8000 | — | |
urlhttps://app.mona.co | — |
Threat ID: 6a842553bf8831d53988215d
Added to database: 08/18/2026, 09:26:43 UTC
Last enriched: 08/18/2026, 10:55:16 UTC
Last updated: 08/18/2026, 10:55:16 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.